Cloudflare has launched a new content management system called EmDash, built over the course of two months with assistance from AI coding agents. It is written entirely in TypeScript, powered by the Astro framework, and fully open source under the MIT license, and is available on GitHub.
EmDash offers isolated plugin sandboxes and a serverless architecture, and can run on any Node.js server.
Positioning EmDash as a Modern Successor to WordPress
In the announcement post, the Cloudflare team highlighted the evolution of web hosting since WordPress was created, “When WordPress was born, AWS EC2 didn’t exist. In the intervening years, that task has gone from renting virtual private servers, to uploading a JavaScript bundle to a globally distributed network at virtually no cost. It’s time to upgrade the most popular CMS on the Internet to take advantage of this change.”
Cloudflare has positioned it as a “spiritual successor” to WordPress and also highlighted that plugins run in secure, isolated sandboxes, called Dynamic Workers, addressing long-standing security issues in WordPress’s plugin system, “ Plugins are securely sandboxed and can run in their own isolate, via Dynamic Workers, solving the fundamental security problem with the WordPress plugin architecture. “
It builds on the legacy of WordPress while introducing modern improvements as stated, “ EmDash is committed to building on what WordPress created: an open source publishing stack that anyone can install and use at little cost, while fixing the core problems that WordPress cannot solve. “
Matt “TK” Taylor, one of the creators of EmDash, shared early traction metrics following the launch, writing, “We’re literally 8 hours into the life of EmDash being a public project: 1.3k GitHub stars, hundreds of excited posts, dozens of great pieces of feedback, a couple of lovely phone calls, and #1 on hacker news (for a bit).”
They also clarified that EmDash has been built entirely from scratch without using any WordPress code, “ While EmDash aims to be compatible with WordPress functionality, no WordPress code was used to create EmDash. “
Those interested can try out EmDash right now in a Playground environment.
Addressing Plugin Security and Marketplace Lock-In Problems
Plugin security has long been a challenge for WordPress, with 91% of vulnerabilities in 2025 coming from plugins.
The team noted that WordPress plugins run directly within the platform with full access to a site’s database and filesystem, “ a WordPress plugin has direct access to the WordPress site’s database and filesystem. When you install a WordPress plugin, you are trusting it with access to nearly everything, and trusting it to handle every malicious input or edge case perfectly.”
EmDash addresses this by running each plugin in a separate, isolated environment called a Dynamic Worker. Instead of giving plugins full access to a site’s data, each plugin is granted only the specific actions it declares it needs, “Rather than giving direct access to underlying data, EmDash provides the plugin with capabilities via bindings, based on what the plugin explicitly declares that it needs in its manifest.“
It also helps address the broader issue of marketplace lock-in, which has long constrained both developers and site owners.
The WordPress plugin marketplace relies heavily on reputation and manual review, and plugins are tightly tied to WordPress code, and developers must license them under GPL if they want to participate, creating a lock-in effect for both sides.
EmDash tackles this challenge in two ways. First, plugins can have any license, “they run independently of EmDash and share no code. It’s the plugin author’s choice.” This gives developers the same freedom they would have when publishing to NPM, PyPi, or other registries, “It’s an open ecosystem for all, and up to the community, not the EmDash project, what license you use for plugins and themes.”
Second, its architecture reduces the need for centralized marketplaces altogether. Each plugin runs in its own secure sandbox with access strictly limited to the capabilities it declares.
It is also designed for serverless environments and leverages the V8 isolate architecture used in Cloudflare’s open-source runtime, workerd. There is also built-in support for x402, an open, neutral standard for internet-native payments, “ EmDash has built-in support for x402. This means anyone with an EmDash site can charge for access to their content without requiring subscriptions and with zero engineering work. “
Architecturally Locked In
FlamingMoe on Hacker News highlighted the architecture lock-in, “ A WordPress spiritual successor backed by Cloudflare sounds great in theory, but the headline feature, plugin isolation via Dynamic Workers, only works on Cloudflare’s runtime. On any other host it’s just a TypeScript CMS without the security model that justifies its existence. Open source but architecturally locked in.”
One more thing to note is that the Dynamic Workers are only currently available on the paid accounts.
Theming and Authentication
EmDash is built on Astro and uses it as the foundation for its frontend theming. Creating a theme involves building an Astro project that includes routes for rendering content, shared layouts, reusable components, styling with CSS or Tailwind, and a JSON file that defines content types and fields within the CMS.
It adopts passkey-based authentication by default, removing the need for passwords and reducing common risks such as leaks and brute-force attacks. It also includes built-in role-based access controls, with predefined roles like administrators, editors, authors, and contributors, each limited to specific permissions. The platform can also integrate with SSO providers.
AI Native by Default
The platform includes tools such as Agent Skills, the EmDash CLI, and a built-in MCP server.
Migrating WordPress to EmDash
EmDash also provides tools for migrating existing WordPress sites. Content can be imported using standard WXR export files or through the EmDash Exporter plugin.
The platform also reworks how custom content structures are managed. In WordPress, extending beyond posts and pages typically involves additional plugins and storing everything within the same posts table.
EmDash instead lets users define schema directly within the admin interface, creating separate collections at the database level, “ you can define a schema directly in the admin panel, which will create entirely new EmDash collections for you, separately ordered in the database.”
The Community Response
Joost de Valk, who previously moved his personal blog off WordPress to Astro, shared, “ EmDash is the most interesting thing to happen to content management in years. Not because it’s built on Astro (though it is), but because it’s the first CMS designed from the ground up for how we work in 2026: AI agents building sites, structured content that machines can parse and manipulate easily, and deployment at the edge.”
Syed Balkhi (CEO of Awesome Motive) highlighted questions around distribution, governance, and adoption, voicing, “ It will be interesting to see whether GoDaddy, Hostinger, etc will be keen to enable 1 click installs of EmDash. Right now that’s not possible because CF has a vendor lock in. “
Victor M Ramirez highlighted the importance of community support, “ Cool but it lacks the major feature that makes WordPress work long term – community. If only one company is contributing to a CMS how can you ensure viability? Amazon, Vox, all had “WordPress killers” and now they’re dead or lagging.”
Rodolfo Melogli also focused on the importance of community, “ Cool tool and all, but honestly, I don’t see how the “EmDash community” can grow, stand out, or be better than the humans of WordPress. Until big brands release just tools, we’re never worried”
Jason Coleman already released a plugin for EmDash, announcing it as, “ Vibe coded throughout the day, and I’ve already started the whiskey. Needs review. Here is a port of Restrict with Stripe for EmDash. This isn’t the x402 stuff. It’s for humans with credit cards to purchase access to your EmDash content using Stripe.”
rita kozlov noted, “ bet cloudflare launching a wordpress successor wasn’t on your 2026 bingo card”
Mike McAlister offered a mixed reaction, noting both interest in the project and criticism of its design approach, “ For a certain kind of builder, this is cool! Expect to see plenty more of the industry coming after WordPress’s marketshare this year. We have work to do! Also kind of funny to create a WP killer but also mimmic its long-dated and exhausted interface. Go big and reinvent it!”
Brad Vincent also pointed to early interest around the project, noting domain activity.
John Turner shared his initial impressions and plans for a deeper review, “ Having been in the WordPress ecosystem for the last 15 years, this looks very interesting. Incoming video tomorrow with my thoughts. I have in my head what an AI first website builder looks like. WordPress will not disappear over night but the market capabilities are changing very fast.”
Nat Miletic offered a skeptical take on EmDash, “Another day another WordPress “killer” Sounds cool but WordPress isn’t going anywhere”
Matt Medeiros also explored the new CMS in detail, offering his take on it.